OpenHW Device: Building the DVWA of Hardware Hacking

Modern developers have platforms like DVWA and OWASP Juice Shop to learn web security, but there is no widely adopted open-source equivalent for learning hardware, firmware, wireless, and embedded security.

OpenHW Device is an open-source, deliberately vulnerable IoT ecosystem designed to teach real-world hardware hacking through hands-on experimentation. The platform combines an ESP32-based smart hub, RFID access control, wireless communication, firmware updates, cryptographic services, and exposed debug interfaces into a single training environment.

The project demonstrates how vulnerabilities across hardware, firmware, wireless protocols, and cryptographic implementations can be chained together to compromise an embedded device.

Topics covered include:

• Firmware extraction and analysis
• UART, SPI, and debug interface discovery
• Hardcoded secret recovery
• RFID cloning attacks
• Wireless replay attacks
• Insecure OTA updates
• Side-channel analysis concepts
• Secure design and mitigation techniques

The live demonstration will walk through a complete attack chain, starting with hardware enumeration and progressing through firmware extraction, secret recovery, wireless exploitation, and device compromise. The session will also discuss practical defenses and secure design approaches for embedded systems.

OpenHW Device is fully open source and aims to become a reusable platform for universities, workshops, security communities, and embedded developers interested in learning hardware security.

Key Takeaways:

• Understanding common hardware and firmware attack paths
• Firmware extraction and reverse engineering techniques
• Identifying insecure debug interfaces and hidden functionality
• Wireless and RFID security fundamentals
• Secure OTA and embedded security best practices
• Building reproducible hardware security training environments